high7.4
CVE-2020-17514
Apache Fineract prior to 1.5.0 disables HTTPS hostname verification in ProcessorHelper in the configureClient method.
Impact
Apache Fineract prior to 1.5.0 disables HTTPS hostname verification in ProcessorHelper in the configureClient method. Under typical deployments, a man in the middle attack could be successful.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Fineract | before 1.5.0 |
References
- NVD record
- CVE.org record
- http://www.openwall.com/lists/oss-security/2021/05/27/2
- https://issues.apache.org/jira/browse/FINERACT-1211
- https://lists.apache.org/thread.html/rc011b25289c8a6e14f8bc6d07e727382a1df3c8cf2aa5369598bbf64%40%3Cdev.fineract.apache.org%3E
- http://www.openwall.com/lists/oss-security/2021/05/27/2
- https://issues.apache.org/jira/browse/FINERACT-1211
- https://lists.apache.org/thread.html/rc011b25289c8a6e14f8bc6d07e727382a1df3c8cf2aa5369598bbf64%40%3Cdev.fineract.apache.org%3E